For about five days now, I've been getting a message that I have a Trojan virus. It doesn'ts say what kind, just that it's dangerous or something like that. I've run every scan known to man, and it tells me that my system is clean. It's running fine. I noticed though, that I can't access something in my Control Panel, which is the Add/Remove thing. Anyonne have any ideas, please. This is a new computer.

Is this "Malware" or something? I just had that happen to me on my laptop at work. It's driving me nuts. Every time I boot up it's there saying it's found 122 critical items, yada yada. I uninstall and it reinstalls itself on every reboot.

Now I understand it's some sort of spyware but I'm going to have to call the IT guys in for this one. It's obviously installing itself in a couple of directories and I have to hunt down where the second is.:mad:

It's pissing me right off but at least doesn't seem to be doing damage or slowing down my machine at all.

I will bump this up for ya Janice. Hopefully Rob will see this and help you.

Did you scan with AVG Anti-Virus Free Edition (http://free.grisoft.com/doc/2/) and AVG Anti-Spyware Free Edition (http://free.grisoft.com/doc/download-free-anti-spyware/)?

You may also want to disable Messenger to see if you stop getting the virus notice (Start > Control Panel > Administrative Tools > Services > Messenger > Properties > Disabled > OK).

Try running your antivirus in safe mode.

you definitely want to run your antispyware programs in SAFEMODE (http://www.pchell.com/support/safemode.shtml), you should also try a squared anti-trojan (http://www.emsisoft.com/en/software/free/) and AVG anti rootkit (http://free.grisoft.com/doc/downloads-products/us/frt/0?prd=arw)

then post a Hijack This (http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html) log.

you definitely want to run your antispyware programs in SAFEMODE (http://www.pchell.com/support/safemode.shtml), you should also try a squared anti-trojan (http://www.emsisoft.com/en/software/free/) and AVG anti rootkit (http://free.grisoft.com/doc/downloads-products/us/frt/0?prd=arw)

then post a Hijack This (http://www.download.com/Trend-Micro-HijackThis/3000-8022_4-10227353.html) log.
The a squared thing caught the trojan. For some reason, the AVG wouldn't connect or something. The trojan was called
Trogan-Downloader.Win32.Delf.fey

Here's my Hijack This log. Thanks Rob.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:20:50 AM, on 3/10/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal
Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Program Files\Common Files\aol\1195963572\ee\aolsoftware.exe
C:\Windows\System32\jureg.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.Exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\AOL 9.1\waol.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\AOL 9.1\shellmon.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Presario&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Presario&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Windows Media Player - {7CF52009-F408-49AE-BBCB-6279CB53BB42} - C:\Windows\wmpdxm.dll (file missing)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: &Crawler Toolbar - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1195963572\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SunJavaUpdateReg] "C:\Windows\system32\jureg.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [a-squared] "C:\Program Files\a-squared Anti-Malware\a2guard.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.1\AOL.EXE" -b
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O13 - Gopher Prefix:
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Plugin Control) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} -
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: a-squared Anti-Malware Service (a2AntiMalware) - Emsi Software GmbH - C:\Program Files\a-squared Anti-Malware\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 8079 bytes

Try running your antivirus in safe mode.
I did. Safe mode scares me. I'm always afraid I'm going to blow up my computer or something, lol.

Did you scan with AVG Anti-Virus Free Edition (http://free.grisoft.com/doc/2/) and AVG Anti-Spyware Free Edition (http://free.grisoft.com/doc/download-free-anti-spyware/)?

You may also want to disable Messager to see if you stop getting the virus notice (Start > Control Panel > Administrative Tools > Services > Messager > Properties > Disabled > OK).
Thanks. I got as far as Services, but can't find Messager.

^Thanks Irene.

Thanks. I got as far as Services, but can't find Messager.
My Bad. It's Messenger.

Safemode is nothing to be afraid of - it is just a way of starting of the computer with no extra programs or drivers running

My Bad. It's Messenger.
I sort of figured that, but that's not there either. *sigh*

Safemode is nothing to be afraid of - it is just a way of starting of the computer with no extra programs or drivers running
I know, it just looks scary, lol. What do you make of my Hijack This log?

i'm still looking through it - i haven't had a lot of time to check it all

i'm still looking through it - i haven't had a lot of time to check it all
Don't put yourself out. Really, I understand if you're busy.

You are welcome Janice. I had seen this thread and I figured no one had noticed it so I bumped it up for ya. ;)

What is SAFEMODE? Why/How does that make a difference?

its ok, I didn't find anything bad in the HijackThis log - does the Trojan warning still come up or was a-squared able to remove it?

another trojan removal tool you could try to remove/verify that it is gone is Stinger (http://vil.nai.com/vil/stinger/) - just follow the step-by-step (ignore step 2) instructions, its pretty straightforward.

You are welcome Janice. I had seen this thread and I figured no one had noticed it so I bumped it up for ya. ;)

What is SAFEMODE? Why/How does that make a difference?
SAFEMODE is an important tool to use when removing spyware and other nasties - basically you are running your computer with ONLY the bare minimum needed to run Windows, so you know that no nasty processes are still running that are going to reinstall the bad stuff the next time you reboot.

if you are infected it is important to run your spyware removal tools in Safemode, and you should always clear all of your temporary files with a tool like CCleaner (http://www.filehippo.com/download_ccleaner/) and its not a bad idea to clear out your System restore points by turning off System Restore then turning it back on again.

its ok, I didn't find anything bad in the HijackThis log - does the Trojan warning still come up or was a-squared able to remove it?

another trojan removal tool you could try to remove/verify that it is gone is Stinger (http://vil.nai.com/vil/stinger/)- just follow the step-by-step (ignore step 2) instructions, its pretty straightforward.
Thanks, Rob. That virus warning stopped, and my computer is working fine, so hopefully that's the end of it. I'm going to do that Stinger thing as well.

Glad to know you got rid of that virus. Like you really needed to deal with that crap while in the process of moving. :crazy:

Guess it was the Ron Jeremy thread or something but for a minute there, I thought you were talking about a rash you got passed through a specific brand of condom.....;)

:brent